ci(github): add explicit permissions to workflows (#1788)

.github/workflows/analyze-codeql.yaml

@@ -9,6 +9,10 @@ on:
   schedule:
   - cron: '0 8 * * 6'
 
+permissions:
+  contents: read
+  security-events: write
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -18,9 +22,6 @@ jobs:
     name: Analyze
     runs-on: ubuntu-24.04
 
-    permissions:
-      security-events: write
-
     steps:
     - name: Checkout Repository
       uses: actions/checkout@v6

.github/workflows/analyze-coverity.yaml

@@ -4,6 +4,9 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/build-check.yaml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true